Difference between revisions of "MANUAL 0 8"
Lostcontrol (talk | contribs) |
Lostcontrol (talk | contribs) |
||
| Line 3: | Line 3: | ||
=== The problem === | === The problem === | ||
| − | Brute-force breakin attempts are quite frequent against an SSH server. Automated scripts try multiple combinations of username/password and sometimes changing the port to something other than 22 can't be done. Furthermore, scouring your log files yourself is not only time consuming, but can be difficult too. | + | Brute-force breakin attempts are quite frequent against an SSH server. Automated scripts try multiple combinations of username/password and sometimes changing the port to something other than 22 can't be done. Furthermore, scouring your log files yourself is not only time consuming, but can be difficult too. |
| − | + | ||
{{Fail2ban}} attempts to aleviate these issues by providing an automated way of not only identifying possible break-in attempts, but acting upon them quickly and easily in a user-definable manor. | {{Fail2ban}} attempts to aleviate these issues by providing an automated way of not only identifying possible break-in attempts, but acting upon them quickly and easily in a user-definable manor. | ||
=== The solution === | === The solution === | ||
| − | Log files contain interesting information, especially about failed logins. This information can be used to ban an offensive host. This is exactly what {{Fail2ban}} does. It scans log files and detect patterns which correspond to possible breakin attempts and then performs actions. Most of the time, it consists of adding a new rule in a firewall chain. | + | Log files contain interesting information, especially about failed logins. This information can be used to ban an offensive host. This is exactly what {{Fail2ban}} does. It scans log files and detect patterns which correspond to possible breakin attempts and then performs actions. Most of the time, it consists of adding a new rule in a firewall chain and sending an e-mail notification to the system administrator. |
| − | + | Here is a list of the most important features available in {{Fail2ban}}: | |
* client/server | * client/server | ||
| Line 18: | Line 18: | ||
* autodetection of the date/time format | * autodetection of the date/time format | ||
* wildcard support in ''logpath'' option | * wildcard support in ''logpath'' option | ||
| + | * support for a lot of services (sshd, apache, qmail, proftpd, sasl, etc) | ||
| + | * support for several actions (iptables, tcp-wrapper, shorewall, mail notifications, etc) | ||
| − | The code has been completely rewritten since | + | The code has been completely rewritten since 0.6.x. {{Fail2ban}} is entirely written in Python and thus should work on most of the *nix systems. |
== Installation == | == Installation == | ||
Revision as of 23:47, 17 October 2006
Introduction
The problem
Brute-force breakin attempts are quite frequent against an SSH server. Automated scripts try multiple combinations of username/password and sometimes changing the port to something other than 22 can't be done. Furthermore, scouring your log files yourself is not only time consuming, but can be difficult too.
Fail2ban attempts to aleviate these issues by providing an automated way of not only identifying possible break-in attempts, but acting upon them quickly and easily in a user-definable manor.
The solution
Log files contain interesting information, especially about failed logins. This information can be used to ban an offensive host. This is exactly what Fail2ban does. It scans log files and detect patterns which correspond to possible breakin attempts and then performs actions. Most of the time, it consists of adding a new rule in a firewall chain and sending an e-mail notification to the system administrator.
Here is a list of the most important features available in Fail2ban:
- client/server
- multithreaded
- Gamin support
- autodetection of the date/time format
- wildcard support in logpath option
- support for a lot of services (sshd, apache, qmail, proftpd, sasl, etc)
- support for several actions (iptables, tcp-wrapper, shorewall, mail notifications, etc)
The code has been completely rewritten since 0.6.x. Fail2ban is entirely written in Python and thus should work on most of the *nix systems.
Installation
Installing from sources on a GNU/Linux system
You will need to obtain the latest version of the source code in order to compile Fail2ban yourself. Once you have done this, change to the directory where you downloaded the source code and execute the following:
tar xvjf fail2ban-x.x.x.tar.bz2
You will have the Fail2ban source code extracted to a directory under the current working directory. You must now move to the new directory.
Now run the installation script as root:
./setup.py install
Fail2ban should now be installed into /usr/lib/fail2ban and /usr/bin.
Debian
Installing Fail2ban on a Debian based system is very straightforward. Execute the following code as the root user on an unstable version of Debian:
apt-get install fail2ban
Gentoo
Fail2ban is available in Portage. To install it, just run:
emerge fail2ban
The FAQ have a more detailed explanation of installing using distributions such as Debian, RedHat and Gentoo
Configuration
The standard path for the configuration is in /etc/fail2ban. This can be set with the -c option of fail2ban-client. A typical configuration looks like this:
/etc/fail2ban/ ├── action.d │ ├── dummy.conf │ ├── hostsdeny.conf │ ├── iptables.conf │ ├── mail-whois.conf │ ├── mail.conf │ └── shorewall.conf ├── fail2ban.conf ├── fail2ban.local ├── filter.d │ ├── apache-auth.conf │ ├── apache-noscript.conf │ ├── couriersmtp.conf │ ├── postfix.conf │ ├── proftpd.conf │ ├── qmail.conf │ ├── sasl.conf │ ├── sshd.conf │ └── vsftpd.conf ├── jail.conf └── jail.local
Every .conf file can be overriden with a file named .local. Modification should take place in the .local and not in the .conf. This avoids merging problem when upgrading. These files are well documented and detailed information should be available there.
- The file fail2ban.conf contains settings like the logging level or the logging target of fail2ban-server. You can also specify here the socket path used for the communication between the client and the server.
- The most important file is probably jail.conf which contains the declaration of your jails.
- The directory action.d contains different scripts defining actions. The actions are executed at well-defined moment during the execution of Fail2ban: when starting/stopping a jail, banning/unbanning an host, etc.
- The directory filter.d contains mainly regular expressions which are used to detect breakin attempts, password failures, etc.
Filter and actions are combinated to create jails. Only one filter is allowed pro jail but it is possible to specify several actions. For example, you can react to a SSH breakin attempt by first adding a new firewall rule, then retrieving some information about the offending host using whois and finally sending yourself an e-mail notification. Or maybe you just want to received a notification on your Jabber account when someone accesses the page /donotaccess.html on your web server.
